Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe
-
Size
989KB
-
MD5
2e7e9626c5bf7a7d9414e99cdf6e6ff9
-
SHA1
5c5e1454ca5242610efa5e2035c798946d67148c
-
SHA256
4b3b65e8d52f092f3c00fe15dc17667b00846a13af082286f3ba2e5c42d9497d
-
SHA512
6de838e353bf5879e5b87b71675d3bb79cc1ab1c0458affcb6d71f99b745b1dea28859323cba0fb5f87c5879bb78f76ae74c36df10a23cba6fd2a4e215296ce1
-
SSDEEP
6144:Qtug8L/GGVGGpoGGtGGG0GG9GGG6GGGsGGGqGGGsGGGIGGGsGGGpGGGsGGGiJJyC:QtuguyXzmUy+DZ1vftM8AkpZi
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2740 2732 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2740 2732 2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2740 2732 2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2740 2732 2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2740 2732 2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 1202⤵
- Program crash
PID:2740
-